On this page
This policy explains how KorttiMarket processes your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act. We collect only the data needed to operate the Service. We do not track users, we do not use advertising cookies and we do not sell your data.
Step 1: Data controller
[Company name Oy]
Business ID: [business ID]
Address: [address]
Email: [email protected]
For privacy matters you can contact the same address. [Data protection officer / contact person: name and email, if appointed.]
Step 2: What data we process
| Data category | Examples | Where the data comes from |
|---|---|---|
| Account data | Email address, username, password hash, language choice, notification settings | From you when registering and in your account settings |
| Profile and contact details | Name, phone number, shipping address, company name and business ID (business sellers) | From you |
| Listings and trades | Listing texts and photos, bids, maximum bids, purchases and sales, shipping and pickup details, watched listings and saved searches | From you and from your use of the Service |
| Feedback | 1–5 star feedback and comments you give and receive | From you and other users |
| Messages and reports | Messages between users, messages you send to support, content reports and complaints | From you and other users |
| Technical data | IP address, browser and device information, login and error logs, push notification subscription (if you turn push on) | From your device |
| Cookies | km_at, km_rt, km_locale, km_ann (strictly necessary only) | From your browser |
We do not ask for data we do not need and we do not process special categories of personal data. Do not include sensitive data in listings or messages.
Step 3: Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and maintaining an account, logging in | Contract (GDPR Art. 6(1)(b)) |
| Publishing listings, carrying out auctions and Buy Now sales, handling bids | Contract |
| Passing on buyer's and seller's contact details so a sale can be completed | Contract |
| Showing feedback and assessing reliability | Legitimate interests (6(1)(f)): building trust on the marketplace |
| Email and push notifications about trades (outbid, won, purchase confirmation) and saved-search alerts | Contract; push notifications only if you turn them on |
| Preventing and investigating abuse, fraud and bid manipulation; security | Legitimate interests; legal obligation |
| Handling content reports, complaints and requests from authorities, identifying business sellers | Legal obligation (6(1)(c)), in particular the Digital Services Act (DSA) |
| Accounting and tax-related obligations | Legal obligation |
| Developing the Service and fixing errors (no individual tracking) | Legitimate interests |
| Any marketing messages | Consent (6(1)(a)); you can withdraw it at any time |
Step 4: Who we disclose data to
Other users. Your username, listings, bid history (under your username) and the feedback you receive are visible to other users. When a sale is made, the buyer and seller see each other's contact details to the extent needed to complete it, for example name, shipping address and email address or phone number. Business sellers' details (name, address, contact details, business ID) are shown in listings as required by law.
Processors. We use service providers that process data on our behalf and under our instructions:
- server hosting: Hetzner Online GmbH (servers within the EU, in Finland and/or Germany);
- email delivery: [service provider, EU];
- [other necessary processors].
We have concluded the data processing agreement required by the GDPR with each processor.
Authorities and others. We disclose data to authorities when required by law or when necessary for the establishment, exercise or defence of legal claims, for example at the request of the police or tax authority. If a business transaction or reorganisation concerning the Service takes place, data may be transferred to a new operator under terms equivalent to this policy.
No advertising, no sale of data. We do not use third-party tracking or advertising tools and we do not disclose your data for marketing purposes.
Step 5: Transfers outside the EU and EEA
Your data is stored and processed within the EU. We do not transfer personal data outside the EU and EEA. If this changes, we will make sure the transfer has a basis under the GDPR and update this policy.
Step 6: How long we keep data
| Data | Retention period |
|---|---|
| Account data and profile | For as long as your account exists. We delete or anonymise the data after the account is deleted unless there is a legal or other basis to keep it. |
| Listings, bids and trade data | While the account exists and afterwards for up to [x] years to resolve disputes and prevent abuse. |
| Feedback | While the account exists. After the account is deleted, feedback may be kept in anonymised form. |
| Technical logs (IP address etc.) | Up to [90] days, longer only during a security investigation or an abuse case. |
| Content reports and statements of reasons for DSA decisions | [x] years, or as long as required by law. |
| Accounting records (if applicable) | The period required by the Accounting Act. |
| Backups | Up to [30] days. |
| Identifiers of closed accounts (e.g. email hash) | [x] years to prevent a banned user from returning. |
Step 7: Cookies and tracking
We only use cookies that are strictly necessary for the Service (login, language choice and closing the announcement bar). We do not use analytics, tracking or advertising cookies. More information: Cookies.
Step 8: Your rights
Under the GDPR you have the right to:
- access your data and know how it is processed;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten") when there is no longer a basis for the processing;
- restrict processing in certain situations;
- object to processing based on legitimate interests;
- move your data from one system to another (data portability);
- withdraw consent at any time where processing is based on consent.
Data export and account deletion. You can download your data in a machine-readable format and delete your account directly in Account settings. Deleting the account prevents use of the account and starts the deletion or anonymisation of data as described in section 6. Deletion does not release you from obligations arising from sales already made and does not remove data we are required by law to keep.
For other requests, contact [email protected]. We respond within one month at the latest. We may ask you to verify your identity.
Right to complain. If you believe your personal data has been processed unlawfully, you can lodge a complaint with the supervisory authority: the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), P.O. Box 800, FI-00531 Helsinki, tietosuoja.fi.
Step 9: Security
We protect data with technical and organisational measures: passwords are stored as hashes, connections are encrypted (HTTPS), access to data is restricted and the servers are in the EU. No system is completely impenetrable. If a data breach puts your rights at risk, we will notify you and the authorities as required by law.
Step 10: Children and young people
Users must be at least 15 years old. Purchases by persons under 18 require a guardian's consent (see Terms of Service). If we discover that an account is held by someone under 15, we will close it and delete the data.
Step 11: Automated decision-making
We do not make decisions about you that have legal effects and are based solely on automated processing or profiling. Automatic bidding in auctions works according to the maximum bid you set, and its rules are described on How buying works. Abuse detection may involve automated checks, but a human always decides whether to close an account.
Step 12: Changes to this policy
We may update this policy. We will notify you of material changes in the Service or by email. The current version is always on this page.